ProfessorProfessor1 hour ago, mnagel said:@Michael Rodrigues Cool, thanks! Now I just need to figure out what to do about my new discovery on how all Windows Event types operate as table scans. Weirdly, we have never had an obvious impact from this until today after all this time (it may explain some issues we have had before, though)
Basically, someone had a server spewing ~120MB of events in the selection window and now I know more than I did before today about how this data is collected. It would be nice to be able to narrow the query up front than repeatedly pull all logs and then filter them! Ticket 212001 if you want to poke your head in :).
Do you happen to know if the event log data is fetched once per ES or is it done once and then filtered via each? The latter would be best, but this is not discussed anywhere I can find. Even so, if one log is growing fast and we want to skip it, the default method has no way to do that. We are considering a Groovy or PowerShell replacement to restrict data pulled prior to filtering.
